Identifying How Firms Manage Cybersecurity Investment

We report on a set of 40 semi-structured interviews with information security executives and managers at a variety of firms and government agencies. The purpose of the interviews was to learn more about how organizations make cybersecurity investment decisions: how much support they receive to execute their mission, how they prioritize which threats to defend against, and how they choose between competing security controls. We find that most private sector executives believe that their firms adequately fund cybersecurity, but that finding qualified personnel inhibits the pace of adoption of new controls. Most firms do not calculate return on investment (ROI) or other outcome-based quantitative investment metrics; instead, they opt for processbased frameworks such as NIST and COBIT to guide strategic investment decisions. Finally, we note that CISOs in government face considerable challenges compared to their private-sector counterparts.